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In the Claims : 

Please add new claims 13-18. The claims are as follows: 

1. (Original) A method of operating an intrusion detection system, the method comprising the 
slops of: 

determining a present alert generation rate of an intrusion detection system; 
comparing the present alert generation rale with an alert generation rate threshold; and 
altering an clement of a signature set of the intrusion detection system responsive to an 
outcome of the step of comparing. 

2. (Original) A method of operating an intrusion detection sensor, the method comprising the 
steps of: 

determining a present alert generation rate of an intrusion detection sensor; 
comparing the present alert generation rate with an alert generation rate threshold; and 
when the present alert generation rate exceeds the alert generation rate threshold, altering 

an element of a signature set of the intrusion detection sensor to decrease an alert generation rate 

of the intrusion detection sensor, 

3. (Original) The method of claim 2, wherein the element is a signature threshold quantity. 

4. (Original) The method of claim 2, wherein the element is a signature threshold interval. 
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5. (Original) A method of operating an intrusion detection system, comprising the steps of: 

monitoring for occurrence of a signature event; and 

when a signature event occurs, increasing a value of a signature event counter and 
comparing the value of the signature event counter with a signature tlu-eshold quantity; and 

when the value of the signature event counter exceeds the signature threshold quantity, 
gencratiug an alert, recording a time of generating the alert in a log, determining from contents of 
the log a present alert generation rate, and comparing the present alert generation rate with an 
alert generation rate threshold; and 

when the present alert generation rate exceeds the alert generation rate threshold, altering 
an clement of a signature set of an intrusion detection system to decrease an alert generation rate 
of an intrusion detection sensor, 

6. (Original) The method of claim 5, wherein the element is a signature threshold quantity. 

7. (Original) The method of claim 5 a wherein the element is a signature threshold interval. 

8. (Original) Programmable media containing programmable software for operation of an 
intrusion detection system, programmable software comprising the steps of: 

determining a present alert generation rate of an intrusion detection system; 
comparing the present alert generation rate with an alert generation rate threshold; and 
altering an clement of a signature set of die intrusion detection system responsive to an 
outcome of the step of comparing. 
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9. (Original) Programmable media containing programmable software for operation of an 
intrusion detection sensor, programmable software comprising the steps of; 

determining a present alert generation rate of an intrusion detection sensor; 
comparing the present alert generation rate with an alert generation rate threshold; and 
when the present alert generation rate exceeds the alert generation rate threshold, altering 

an element ofa signature set of the intrusion detection sensor to decrease an alert generation rate 

of the intrusion detection sensor. 

10. (Original) Programmable media containing programmable software for operation of an 
intrusion detection system, programmable software comprising the steps of: 

monitoring for occurrence ofa signature event; and 

when a signature event occurs, increasing a value of a signature event counter and 
comparing the value of the signature event counter with a signature threshold quantity; and 

when the value of the signature event counter exceeds the signature threshold quantity, 
generating an alert, recording a time of generating the alert in a log, determining from contents of 
the log a present alert generation rate, and comparing the present alert generation rate with an 
alert generation rate threshold; and 

when the present alert generation rate exceeds the alert generation rate threshold, altering 
an clement ofa signature set of an intrusion detection system to decrease an alert generation rale 
of an intrusion detection server. 
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11, (Original) The programmable media of claim 10, wherein the element is a signature threshold 
quantity, 

12, (Original) The programmable media of claim 10, wherein the element is a signature threshold 
interval. 

13, (New) The method of claim 1, wherein the altering step comprises altering the element of the 
signature set of the intrusion detection system responsive to only the outcome of the step of 
comparing. 

14, (New) The method of claim 2, wherein the step of altering the clement of the signature set of 
the intrusion detection sensor is responsive to only the present alert generation rate exceeding the 
alert generation rate threshold, 

15, (New) The method of claim 5, wherein the step of altering the element of the signature set of 
the intrusion detection sensor is responsive to only the present alert generation rate exceeding the 
alert generation rate threshold. 

16, (New) The method of claim 8, wherein the altering step comprises altering the element of the 
signature set of the intrusion detection system responsive to only the outcome of the step of 
comparing. 
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17. (New) The method of claim 9, wherein the step of altering the clement of the signature set of 
tlio intrusion detection sensor is responsive to only the present alert generation rate exceeding the 
alert generation rate threshold. 

1 8. (New) The method of claim 10, wherein the step of altering the element of the signature set 
of the intrusion detection sensor is responsive to only the present alert generation rate exceeding 
the alert generation rate threshold. 
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